Python OpenSSL.crypto方法代码示例

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def test_validate_cert(self, circuits_app, https_url, expected_results):
        """ Test the functions return type 'Certificate'
            When the function is successful in parsing the URL
            It should return a value we can parse into a certificate

            OpenSSL.crypto.load_certificate should be able to get a valid certificate

            When the function isint successful -- None"""
        function_params = {
            "https_url": https_url
        }
        # If we expected the result to be unsuccesful it should raise an error
        if expected_results['successful'] == False:
            with pytest.raises(Exception):
                call_utilities_extract_ssl_cert_from_url_function(circuits_app, function_params)

        else:

            results = call_utilities_extract_ssl_cert_from_url_function(circuits_app, function_params)
            if results['successful']:
                assert (isinstance(
                    OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, json.loads(results['certificate'])),
                    X509))  # Assert our successful results are of type X509
            else:
                assert (isinstance(results['certificate'], type(None))) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def certificate_to_string(certificate: TS.X509) -> str:
    """
    Take an x509 certificate and encode it to a string suitable for adding to
    XML responses.

    :param certificate: A certificate,
        perhaps loaded from :func:`certificate_from_file`.
    """
    pem_bytes = OpenSSL.crypto.dump_certificate(
        OpenSSL.crypto.FILETYPE_PEM, certificate)
    return ''.join(pem_bytes.decode('ascii').strip().split('\n')[1:-1]) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def certificate_from_string(
    certificate: str,
    format=OpenSSL.crypto.FILETYPE_PEM,
) -> TS.X509:
    """
    Load an X509 certificate from a string. This just strips off the header and
    footer text.

    :param str: A certificate string.
    :param format: The format of the certificate, from :doc:`OpenSSL:api/crypto`.
    """
    return OpenSSL.crypto.load_certificate(format, certificate) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def certificate_from_file(
    filename: Union[str, pathlib.Path],
    format=OpenSSL.crypto.FILETYPE_PEM,
) -> TS.X509:
    """Load an X509 certificate from ``filename``.

    :param filename: The path to the certificate on disk.
    :param format: The format of the certificate, from :doc:`OpenSSL:api/crypto`.
    """
    with open(filename, 'r') as handle:
        return certificate_from_string(handle.read(), format) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def private_key_from_string(
    private_key: str,
    format=OpenSSL.crypto.FILETYPE_PEM,
) -> TS.PKey:
    """Load a private key from a string.

    :param str: A private key string.
    :param format: The format of the private key, from :doc:`OpenSSL:api/crypto`.
    """
    return OpenSSL.crypto.load_privatekey(format, private_key) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def private_key_from_file(
    filename: Union[str, pathlib.Path],
    format=OpenSSL.crypto.FILETYPE_PEM,
) -> TS.PKey:
    """Load a private key from ``filename``.

    :param filename: The path to the private key on disk.
    :param format: The format of the private key, from :doc:`OpenSSL:api/crypto`.
    """
    with open(filename, 'r') as handle:
        return private_key_from_string(handle.read(), format) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def _parse_cert(self, content: str) -> X509:
        return OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, content.encode()) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def _gen_cert(self, key, cert):
        p12 = OpenSSL.crypto.PKCS12()
        p12.set_privatekey(key)
        p12.set_certificate(cert)

        return p12 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def _generate_key(self):
        key = OpenSSL.crypto.PKey()
        key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)

        return key 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def _get_public_key(self, key) -> str:
        return OpenSSL.crypto.dump_publickey(OpenSSL.crypto.FILETYPE_PEM, key).decode() 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def get_subj_alt_name(peer_cert):
        '''
        Copied from ndg.httpsclient.ssl_peer_verification.ServerSSLCertVerification
        Extract subjectAltName DNS name settings from certificate extensions
        @param peer_cert: peer certificate in SSL connection.  subjectAltName
        settings if any will be extracted from this
        @type peer_cert: OpenSSL.crypto.X509
        '''
        # Search through extensions
        dns_name = []
        general_names = SubjectAltName()
        for i in range(peer_cert.get_extension_count()):
            ext = peer_cert.get_extension(i)
            ext_name = ext.get_short_name()
            if ext_name == b"subjectAltName":
                # PyOpenSSL returns extension data in ASN.1 encoded form
                ext_dat = ext.get_data()
                decoded_dat = der_decoder.decode(ext_dat, asn1Spec=general_names)

                for name in decoded_dat:
                    if isinstance(name, SubjectAltName):
                        for entry in range(len(name)):
                            component = name.getComponentByPosition(entry)
                            n = bytes(component.getComponent())
                            if n.startswith(b"*"):
                                continue
                            dns_name.append(n)
        return dns_name 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def create_ca():
        key = OpenSSL.crypto.PKey()
        key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)
        ca = OpenSSL.crypto.X509()
        ca.set_version(2)
        ca.set_serial_number(0)
        subj = ca.get_subject()
        subj.countryName = 'CN'
        subj.stateOrProvinceName = 'Internet'
        subj.localityName = 'Cernet'
        subj.organizationName = CertUtil.ca_vendor
        # Log generated time.
        subj.organizationalUnitName = '%s Root - %d' % (CertUtil.ca_vendor, int(time.time()))
        subj.commonName = '%s XX-Net' % CertUtil.ca_vendor
        ca.gmtime_adj_notBefore(- 3600 * 24)
        ca.gmtime_adj_notAfter(CertUtil.ca_validity - 3600 * 24)
        ca.set_issuer(subj)
        ca.set_subject(subj)
        ca.set_pubkey(key)
        ca.add_extensions([
            OpenSSL.crypto.X509Extension(
                b'basicConstraints', False, b'CA:TRUE', subject=ca, issuer=ca)
            ])
        ca.sign(key, CertUtil.ca_digest)
        #xlog.debug("CA key:%s", key)
        xlog.info("create CA")
        return key, ca 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def generate_ca_file():
        xlog.info("generate CA file:%s", CertUtil.ca_keyfile)
        key, ca = CertUtil.create_ca()
        with open(CertUtil.ca_certfile, 'wb') as fp:
            fp.write(OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, ca))
        with open(CertUtil.ca_keyfile, 'wb') as fp:
            fp.write(OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, ca))
            fp.write(OpenSSL.crypto.dump_privatekey(OpenSSL.crypto.FILETYPE_PEM, key)) 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def generate_cert_keyfile():
        xlog.info("generate certs's key file:%s", CertUtil.cert_keyfile)
        pkey = OpenSSL.crypto.PKey()
        pkey.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)
        with open(CertUtil.cert_keyfile, 'wb') as fp:
            fp.write(OpenSSL.crypto.dump_privatekey(OpenSSL.crypto.FILETYPE_PEM, pkey))
            fp.write(OpenSSL.crypto.dump_publickey(OpenSSL.crypto.FILETYPE_PEM, pkey))
        CertUtil.cert_publickey = pkey 

# 需要导入模块: import OpenSSL [as 别名]
# 或者: from OpenSSL import crypto [as 别名]
def _get_old_cert(commonname):
        certfile = os.path.join(CertUtil.ca_certdir, utils.to_str(commonname) + '.crt')
        if os.path.exists(certfile):
            with open(certfile, 'rb') as fp:
                cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, fp.read())
            if datetime.datetime.strptime(utils.to_str(cert.get_notAfter()), '%Y%m%d%H%M%SZ') < datetime.datetime.utcnow() + datetime.timedelta(days=30):
                try:
                    os.remove(certfile)
                except OSError as e:
                    xlog.warning('CertUtil._get_old_cert failed: unable to remove outdated cert, %r', e)
                else:
                    return
                # well, have to use the old one
            return certfile